linux-toradex.git/arch/x86/mm/pat, branch master

Merge tag 'x86_cpu_for_v7.3_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

2026-08-19T02:09:42+00:00

Pull x86 cpuid updates from Borislav Petkov:

 - Get rid of static_cpu_has() - one less API to care about testing CPU
   features

 - Unify the handling of CPU core types (performance, efficient, etc) by
   mapping the vendor-specific types to Linux ones

 - Continuation of the work of Ahmed Darwish to centralize CPUID leaf
   representation

* tag 'x86_cpu_for_v7.3_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  x86/CPU: Rename struct cpuid_read_output to struct cpuid_output
  x86/cpu/scattered: Sort it properly
  x86/cpu: Use parsed CPUID(0x1)
  x86/lib: Add CPUID(0x1) family and model calculation
  x86/cpu: Use parsed CPUID(0x0)
  x86/cpu/transmeta: Rescan CPUID(0x1) after modifying capabilities
  x86/topology: Add TOPO_CPU_TYPE_LOW_POWER
  x86/topology: Name the AMD core-type values
  x86/topo: Map vendor CPU types to generic Linux such types
  x86/bugs: Don't use cpu-type matching in cpu_vuln_blacklist
  x86/cpu: Hide and rename static_cpu_has()

x86/mm: Fix and document DEBUG_PAGEALLOC

2026-08-05T12:19:35+00:00

It turns out that commit 5fce67641a3e ("x86/mm/pat: Don't gate
cpa_lock on debug_pagealloc_enabled()") was a little too quick to
remove the debug_pagealloc exception for cpa_lock.

Notably __kernel_map_pages() is used by the page-allocator from any
context the page-allocator itself is used, which violates the cpa_lock
rules.

Re-instate the exception, except make it specific to the
__kernel_map_pages() such that any other cpa() usage is still fully
serialized by cpa_lock. Also note that since cpa() should not be used
on memory that isn't allocated, the page-allocator locking and cpa are
infact mutually exclusive and all cpa usage in fully serialized.

Add a comment explaining this and other 'funnies' surrounding
DEBUG_PAGEALLOC, including how pgd_lock is not affected and the TLB
trickery.

Fixes: 5fce67641a3e ("x86/mm/pat: Don't gate cpa_lock on debug_pagealloc_enabled()")
Signed-off-by: Peter Zijlstra (Intel) 
Link: https://patch.msgid.link/20260729111119.604452135@infradead.org

x86/mm: Use guard() for pgd_lock

2026-08-05T12:19:35+00:00

Signed-off-by: Peter Zijlstra (Intel) 
Link: https://patch.msgid.link/20260729111119.488154104@infradead.org

x86/mm: Use guard() in cpa_collapse_large_pages()

2026-08-05T12:19:35+00:00

Signed-off-by: Peter Zijlstra (Intel) 
Link: https://patch.msgid.link/20260729111119.375614011@infradead.org

x86/mm/pat: Take cpa_lock around large-page collapse

2026-07-15T20:06:55+00:00

Loading and unloading modules concurrently on several CPUs on a KASAN
build, with a short delay injected at the CPA page-table lookup to
widen the window, faults within minutes:

  BUG: KASAN: use-after-free in __change_page_attr+0x7cc/0x7e0
  Write of size 8 at addr ffff888181139718 by task modprobe
  ...
  The buggy address belongs to the physical page:
   pfn:0x181139 ... page_type: f2(table)

cpa_collapse_large_pages() rebuilds a leaf PMD from its 4K PTEs and
frees the old PTE-table pages, while __change_page_attr() fetches a
PTE pointer from a lockless lookup_address_in_pgd_attr() and writes
it with set_pte_atomic() only later. When module text is served from
a shared large ROX mapping the two run on the same PMD:

  CPU A (module load)              CPU B (module finalize)
  -------------------              -----------------------
  execmem_make_temp_rw
   set_memory_nx
    __change_page_attr
     split 2M -> 4K table P
     kpte = &P[i]  (lockless)
                                   execmem_restore_rox
                                    set_memory_rox (CPA_COLLAPSE)
                                     cpa_collapse_large_pages
                                      rebuild leaf PMD
                                      flush_tlb_all
                                      pagetable_free(P)
     set_pte_atomic(kpte, ...)
       -> writes into freed P

P is a page-table page (page_type: table), reused at once, so the
write corrupts whatever got the page next: a bad-pte or bad-page
splat, or a fatal fault once P has been turned into read-only text.

The flush_tlb_all() before the free does not close this: its IPI only
serializes against page-table walkers that run with interrupts off
(e.g. GUP-fast); the walk in __change_page_attr() runs with interrupts
on, so nothing stops it from holding a stale pointer into P.

Serialize the collapse - the PMD rebuild, TLB flush and PTE-table
free - under cpa_lock, the same lock __change_page_attr() now takes
unconditionally since commit ("x86/mm/pat: stop gating cpa_lock on
debug_pagealloc_enabled()"), so a concurrent walker can no longer
hold a pointer into a table the collapse is about to free.

Fixes: 41d88484c71c ("x86/mm/pat: restore large ROX pages after fragmentation")
Signed-off-by: Denis V. Lunev 
Signed-off-by: Dave Hansen 
Acked-by: Kiryl Shutsemau (Meta) 
Link: https://patch.msgid.link/20260715183453.2381141-1-den@openvz.org

x86/mm/pat: Don't gate cpa_lock on debug_pagealloc_enabled()

2026-07-15T15:00:49+00:00

The splitting and merging of kernel page table mappings between small and
large is protected by cpa_lock. The merging is relatively new but the
splitting is ancient.

The splitting has a locking optimization: since DEBUG_PAGEALLOC forces all
mappings to 4k, there are no large pages to split. So the code that *might*
cause a split can just skip the locking (and a few other things).

This is entertaining, but it adds complexity and makes for weird locking
rules. Plus it's all for a debugging feature which makes the kernel super
slow in the first place. Optimizing something which is already super slow
and not used in production is not the best way to spend our complexity
budget.

Stop gating cpa_lock on debug_pagealloc_enabled() to simplify the code
and the locking rules.

[ dhansen: flesh out changelog ]

Suggested-by: Dave Hansen 
Signed-off-by: Mike Rapoport (Microsoft) 
Signed-off-by: Dave Hansen 
Link: https://patch.msgid.link/20260715144519.934289-1-rppt@kernel.org
Link: https://lore.kernel.org/all/aab44f08-89f8-47fe-bee4-0ab6b25968c6@intel.com/

x86/mm/pat: Convert collapse_pmd_page() to ptdescs

2026-07-13T22:55:10+00:00

Convert collapse_pmd_page() to ptdescs in preparation for the
eventual splitting of ptdescs from struct page.

Signed-off-by: Vishal Moola 
Signed-off-by: Dave Hansen 
Reviewed-by: William Kucharski 
Acked-by: Mike Rapoport (Microsoft) 
Link: https://patch.msgid.link/20260629185742.126987-4-vishal.moola@gmail.com

x86/mm/pat: Convert __set_pmd_pte() to ptdescs

2026-07-13T22:55:10+00:00

Convert __set_pmd_pte() to ptdescs in preparation for the eventual
splitting of ptdescs from struct page.

Signed-off-by: Vishal Moola 
Signed-off-by: Dave Hansen 
Reviewed-by: William Kucharski 
Acked-by: Mike Rapoport (Microsoft) 
Link: https://patch.msgid.link/20260629185742.126987-3-vishal.moola@gmail.com

x86/mm/pat: Use IS_ENABLED() instead of ifdef

2026-07-13T22:55:09+00:00

Use IS_ENABLED() to check if we are on 32 bit. This standardizes this
check with the other 32 bit check in the file. No functional changes.

Signed-off-by: Vishal Moola 
Signed-off-by: Dave Hansen 
Reviewed-by: William Kucharski 
Acked-by: Mike Rapoport (Microsoft) 
Link: https://patch.msgid.link/20260629185742.126987-2-vishal.moola@gmail.com

x86/cpu: Hide and rename static_cpu_has()

2026-07-07T04:34:26+00:00

cpu_feature_enabled() is the one to use to test feature flags so hide
the static thing which doesn't pay attention to disabled mask bits
anyway.

Use the following command to do the replacement:

  $ git grep --files-with-matches -w static_cpu_has -- ':(exclude)*cpufeature.h' \
  | xargs sed -i 's/static_cpu_has(/cpu_feature_enabled\(/g'

There should be no functional changes resulting from this.

Signed-off-by: Borislav Petkov (AMD) 
Reviewed-by: Nikolay Borisov 
Link: https://patch.msgid.link/20260620015041.336288-1-bp@kernel.org